Login or Register to Ask a Question and Join Our Community


UNIX for Advanced & Expert Users

Is it, and if so, how is it possible to intercept system messages going to SYSLOG

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Is it, and if so, how is it possible to intercept system messages going to SYSLOG
# 1  
Old 03-26-2009
Is it, and if so, how is it possible to intercept system messages going to SYSLOG
HI all,

I'm trying to improve my systems to detect attempts to break in to my servers. For instance, I currently use crontab checking the /var/log/messages every 1 minute, but I feel it would be more efficient to do the processing only when messages are generated.

Is this possible, and if so how?

kr
gary
# 2  
Old 03-26-2009
What daemons generate these messages? Maybe you can redirect their output to your programs?..
# 3  
Old 03-26-2009
It is the PAM Authentication module I guess, and I *really* don't want to go there.

I guess I could call what I want a "sniffer" on the stream of syslog messages, somewhat analogous to an ethernet sniffer, where you just look at the data, and don't interfere with it in any way.

kind regards

gary
# 4  
Old 03-26-2009
Well, on my Solaris I've found something interesting in log(7D). As I understand online manuals I skimmed, you need to write program which will catch all messages, going to STREAM driver in /dev/log... Whether it's possible or not I can't say now
# 5  
Old 03-26-2009
Hmmm, sounds like a C job to me ...

Thanks ... I'll keep an eye out.

kind regards

gary
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Svc messages flooding the system logs every second

Hi all I have a newly installed Oracle X2-4 server running Solaris 10 x86 with the latest patches. I have one non-global zone configured running an Oracle DB instance. After configuring IPMP failover between two NICs on the server and rebooting I am seeing the /var/adm/messages being flooded... (7 Replies)
Discussion started by: notreallyhere
7 Replies

2. UNIX for Advanced & Expert Users

Scan all mail messages through the server and save a copy into file system following a rule

In our company we work for our customer with a job# philosophy, managing all the informations about a job in a share with directories whose name is starting with job number. Under this entry point we have a standard structure of folders, comprising a "communications" folder. When we send emails... (0 Replies)
Discussion started by: vroby67
0 Replies

3. Homework & Coursework Questions

program to send messages to parent using pipes and select system call

Write a program using select, which will create some number of child processes that continuously send text messages to the parent process using pipes. Each child has its own pipe that it uses to communicate with the parent. The parent uses select () to decide what pipes should be processed to... (1 Reply)
Discussion started by: ripssingh
1 Replies

4. UNIX for Advanced & Expert Users

Video Cards :: Video Memory Intercept and Redirect

I need a broad spectrum understanding on this subject, and any help would be greatly appreciated. First of all, as I understand it... The way the video hardware works is the CPU sends information about input and possible changes to the display, the video card receives these changes, makes the... (2 Replies)
Discussion started by: ciNG
2 Replies

5. Red Hat

syslog messages.

Good Day. Any idea on the messages log. it would be a great help to us. Upon checking the on the system logs, I found the following messages: EXT3-fs: INFO: recovery required on readonly filesystem. EXT3-fs: write access will be enabled during recovery. kjournald... (1 Reply)
Discussion started by: cabloy
1 Replies

6. AIX

How to intercept sytem calls

I would like to port a small utility from Linux to AIX and, lacking any software development knowledge for AIX, need some help: I have a library called Snoopy. Basically it intercepts the execv() and execve() system calls and logs them to the syslog-facility AUTHPRIV then passes control over to... (1 Reply)
Discussion started by: bakunin
1 Replies

7. Shell Programming and Scripting

Script to send something via UDP and intercept at other end?

I am looking to do a shell script that can send something simple via UDP from server 1 - to server 2 I want to be able to see on server 2 that I received everything expected.. ie.. I am looking at this to avoid using ping / traceroute to highlight network issues.. if a UDP packet gets lost... (1 Reply)
Discussion started by: frustrated1
1 Replies

8. IP Networking

intercept the ip address of a telnet session

The situation: a Unix system (UnixWare 7.1.3) to which are connected other systems; various p.c. on the LAN that they connect Unix to the system via TelNet. The problem: I need to intercept the address IP of the p.cs. connected via telnet to the Unix system. Particularly, I have to know the... (2 Replies)
Discussion started by: paololrp
2 Replies

9. UNIX for Advanced & Expert Users

System Error messages

Hi Experts, I'm getting the following errors on /var/adm/messages file permanently. Dec 28 10:19:38 ioocsrv1 bsd-gw: open(dfA415ioocsrv3): File exists Dec 28 10:20:53 ioocsrv1 bsd-gw: open(dfA415ioocsrv3): File exists Dec 28 10:22:08 ioocsrv1 bsd-gw: open(dfA415ioocsrv3): File exists Dec... (1 Reply)
Discussion started by: nikk
1 Replies

10. UNIX for Dummies Questions & Answers

system messages log (Sun and AIX)

Hello, I need a few explanation about the log files for system messages: /var/adm/messages and /var/log/syslog. As /var/adm/messages is empty on my machine, i need help. First, i would like to know what the difference between these 2 files is? Do they contain different kinds of system... (3 Replies)
Discussion started by: VeroL
3 Replies
Login or Register to Ask a Question